Zscaler ZIA - Multi-User Phishing Campaign - Same Domain Hit by 3+ Users in 1 Hour

27 CSL Zscaler Multi User Phishing Campaign

Query

CommonSecurityLog
| where TimeGenerated > ago(1h)
| where DeviceVendor == "Zscaler"
| where isnotempty(DestinationHostName) and isnotempty(SourceUserName)
| where DeviceCustomString2 has_any (
    "PHISHING", "ADVANCED_SECURITY_RISK", "BOTNET_SITES",
    "MALWARE_SITES", "SUSPICIOUS_DESTINATIONS", "MALICIOUS_LINKS")
| summarize
    UserCount    = dcount(SourceUserName),
    Users        = make_set(SourceUserName, 20),
    Actions      = make_set(DeviceAction, 5),
    URLSamples   = make_set(RequestURL, 5),
    Category     = any(DeviceCustomString2),
    FirstHit     = min(TimeGenerated),
    LastHit      = max(TimeGenerated),
    RepURL       = any(DestinationHostName)
  by DestinationHostName
| where UserCount >= 3
| order by UserCount desc

Explanation

This query is designed to detect potential phishing campaigns by identifying when three or more distinct users access the same domain within a one-hour period. The domain must be classified by Zscaler ZIA as a phishing, advanced security risk, botnet, or malware site. The query runs every hour and checks logs from the past hour to find such occurrences.

Here's a breakdown of what the query does:

Data Source: It uses logs from Zscaler, specifically looking at security events.
Time Frame: It examines events from the last hour.
Conditions: It filters for events where:
- The domain accessed is classified as a security risk (e.g., phishing, malware).
- At least three different users have accessed the same domain.
Output: It summarizes the data to show:
- The number of users who accessed the domain.
- A list of these users.
- Actions taken.
- Sample URLs accessed.
- The category of the threat.
- The first and last time the domain was accessed within the hour.
Alerting: If the conditions are met, an alert is generated with details about the domain and the number of users involved.
Incident Management: It creates an incident if such an event is detected, grouping related alerts to avoid duplicates.

This query helps security teams quickly identify and respond to potential phishing campaigns targeting multiple users in a short time frame.

Details

David Alonso

Released: March 2, 2026

Tables

CommonSecurityLog

Keywords

CommonSecurityLogTimeGeneratedDeviceVendorDestinationHostNameSourceUserNameDeviceCustomString2DeviceActionRequestURLUserCountUsersActionsURLSamplesCategoryFirstHitLastHitRepURLUrl

Operators

agohas_anyisnotemptysummarizedcountmake_setanyminmaxorder by

Severity

High

Tactics

InitialAccess

MITRE Techniques

T1566 T1192

Frequency: PT1H

Period: PT1H

Actions

GitHub

KQL Search